Deploy vCNS Edge

vCloud Networking and Security has the capabilities to provide edge services inside of your virtual environment.  Edge firewalls, network address translation, DHCP, routing are all things that vCNS Edge can do for you.  This post goes into the steps necessary to deploy vCNS Edge.

I should mention that vCNS and the previous name vShield may be used interchangeably in this article.

Logical Diagram

The picture below is a diagram of what our environment will look like when we’re done.  We have production VMs as you might expect, and our new vCNS Edge VM.  We’ve also got our new Edge network and a Shielded VM which will not be connected to the production vSwitch directly.

LogicalDiagram-vCNSEdge

 

Deploy vCNS Edge

The first step is to have your vCNS Manager deployed.  I’ve done this in a previous post, so if you haven’t done this yet, you’ll need to do this first.   Remember that Edge is a component of vCNS so vCNS Manager needs to be installed first.

Now that the vCNS services are ready to go, we can deploy the edge services.  Go to your vCNS portal, select your datacenter, and then go to the “Network Virtualization” tab.

Click the “+” sign to add a new edge device.

vCNS-Edge1

Give your new Edge Appliance a name, and description.  You can also enable HA but in my environment I’m only using a single host anyway for this deployment so I’ve left it off.vCNS-Edge2

Set a password and a username for cli logins and check whether or not you want the communication to be SSH or not.

vCNS-Edge3

Select the size of the appliance.

The sizes of the appliance makes a difference on the capabilities.  I urge you to take a look at the following VMware Blog post discussing the differences.

Also, if you’re doing this in the lab, I highly recommend the “Enable auto rule generation” to help you set your rules.

vCNS-Edge4

Next you’ll need to enter information about the edge appliance virtual machine.  Much like and OVA deployment, you’ll need a cluster, datastore, host etc.

vCNS-Edge5

 

We can add up to 10 interfaces.  These interfaces typically come in two forms.

1.  An uplink

2.  An Internal Link

Click Add

vCNS-Edge6

My first Nic I create my uplink.  This uplink is like the default gateway and connects to my production network.  Mileage may vary but this is how I’ve configured my lab.  Give it a name, and select the port group this nic will be connected to.

vCNS-Edge7

I’ve chosen the Prod port group to connect my uplink to.

vCNS-Edge8

Next, you’ll need to give it an IP Address.  I’ve given it an IP Address and entered a subnet mask as well.

vCNS-Edge9

Next, I add a second nic and this time it’s an internal network.  You’ll go through the same process of adding an IP Address here as well.  I recommend a standardization such as x.x.x.254 for all the internal IP Addresses so that you’ll have a x.x.x.254 as the default gateway on each of the internal networks.

vCNS-Edge10

I’ve only added 1 uplink and 1 internal nic, so when I’m finished it looked something like this.

vCNS-Edge11

Next we configure a default gateway.  I’ve selected my uplink and the IP Address of the gateway.  If you’re using jumbo frames, you can change the MTU size here.  Otherwise leave this alone.

vCNS-Edge12

This is a lab and I’m keeping things simple.  Therefore, I’m allowing all traffic through the appliance at this point.  If this is a production environment, you’ll likely change this to deny and manually enter each rule for the traffic you’re going to allow.

vCNS-Edge13

Review the summary and click finish.

vCNS-Edge14

Once you click finish you’ll see the edge device being deployed.

vCNS-Edge15

After some time, you’ll see that it has been deployed.

vCNS-Edge16

 

Summary

Deploying the vShield Edge appliance is just the first step.  Now that the edge device is available, a wealth of new opportunities are available to you which I’ll discuss further in new posts.

 

Leave a reply